Location via proxy:   [ UP ]  
[Report a bug]   [Manage cookies]                
Scribd Logo
Upload

Welcome to Scribd!

  • 551 views

    Password Management

    Uploaded by

    jim
    This document discusses password management and security. It covers how passwords authenticate users and determine privileges. Passwords are vulnerable to attacks, so systems implement techniques like password hashing with salts to protect passwords stored in files. The document also discusses strategies for users to select strong, secure passwords such as following guidelines, using computer-generated passwords, and systems checking passwords for strength.

    Copyright:

    © All Rights Reserved
    Download as PPTX, PDF, TXT or read online from Scribd

    Password Management

    Uploaded by

    jim
    551 views16 pages
    This document discusses password management and security. It covers how passwords authenticate users and determine privileges. Passwords are vulnerable to attacks, so systems implement techniques like password hashing with salts to protect passwords stored in files. The document also discusses strategies for users to select strong, secure passwords such as following guidelines, using computer-generated passwords, and systems checking passwords for strength.

    Original Description:

    about Password Management

    Copyright

    © © All Rights Reserved

    Available Formats

    PPTX, PDF, TXT or read online from Scribd

    Did you find this document useful?

    Is this content inappropriate?

    This document discusses password management and security. It covers how passwords authenticate users and determine privileges. Passwords are vulnerable to attacks, so systems implement techniques like password hashing with salts to protect passwords stored in files. The document also discusses strategies for users to select strong, secure passwords such as following guidelines, using computer-generated passwords, and systems checking passwords for strength.

    Copyright:

    © All Rights Reserved
    Download as PPTX, PDF, TXT or read online from Scribd
    Download as pptx, pdf, or txt
    551 views16 pages

    Password Management

    Uploaded by

    jim
    This document discusses password management and security. It covers how passwords authenticate users and determine privileges. Passwords are vulnerable to attacks, so systems implement techniques like password hashing with salts to protect passwords stored in files. The document also discusses strategies for users to select strong, secure passwords such as following guidelines, using computer-generated passwords, and systems checking passwords for strength.

    Copyright:

    © All Rights Reserved
    Download as PPTX, PDF, TXT or read online from Scribd
    Download as pptx, pdf, or txt
    of 16

    Password Management

    Password Management
    Password Protection: The front
    line of defense against intruders is
    the password system. Virtually all
    multiuser systems require that a user
    provide not only a name or identifier
    (ID) but also a password. The
    password serves to authenticate the
    ID of the individual logging on to the
    system. In turn, the ID provides
    security in the following ways:

    The ID determines whether the user


    is authorized to gain access to a
    system.
    The ID determines the privileges
    accorded to the user.

    The Vulnerability of Passwords:


    let us consider a scheme that is
    widely used on UNIX:
    Each user selects a password up to eight
    characters.
    This is converted into a 56-bit value (key
    input to an encryption routine).
    The encryption routine is based on DES.
    The DES algorithm is modified using a
    12-bit.
    This value is related to the time at which

    The modified DES algorithm is exercised with a


    data input consisting of a 64-bit block of zeros.
    The output of the algorithm then serves as
    input for a second encryption.
    This process is repeated for a total of 25
    encryptions.
    The resulting 64-bit output is then translated
    into an 11-character sequence.
    The hashed password is then stored, together
    with a plaintext copy of the salt, in the
    password file

    The salt serves three purposes:


    It prevents duplicate passwords
    from being visible in the password
    file.
    It effectively increases the length
    of the password without requiring
    the user to remember additional
    characters.

    Access Control: One way to thwart


    a password attack is to deny the
    opponent access to the password
    file. If the encrypted password
    portion of the file is accessible only
    by a privileged user, then the
    opponent cannot read it without
    already knowing the password of a
    privileged user.

    Password Selection Strategies:


    The goal is to eliminate guessable
    passwords while allowing the user to
    select a password that is memorable.
    Four basic techniques are in use:
    User education.
    Computer-generated passwords.
    Reactive password checking.
    Proactive password checking.

    User education
    Users can be told the importance of
    using hard-to-guess passwords and can
    be provided with guidelines for selecting
    strong passwords.
    Computer-generated passwords
    passwords are quite random in nature
    Reactive password checking
    the system periodically runs its own
    password cracker to find guessable
    passwords. The system cancels any
    passwords that are guessed

    Proactive password checking


    user is allowed to select his or her own
    password. However, at the time of
    selection, the system checks to see if
    the password is allowable and, if not,
    rejects it.
    The trick with a proactive password
    checker is to strike a balance between
    user acceptability and strength.

    Proactive password checking


    approaches:
    Rule enforcement:
    All passwords must be at least eight
    characters long.
    The passwords must include at least one
    each of uppercase, lowercase, numeric
    digits, and punctuation marks.

    Another possible procedure is simply to


    compile a large dictionary of possible
    "bad" passwords.

    Proactive password checker


    techniques
    Markov model: generation of guessable
    passwords, this model shows a language
    consisting of an alphabet of three
    characters. The state of the system at
    any time is the identity of the most
    recent letter. The value on the transition
    from one state to another represents the
    probability that one letter follows
    another. Thus, the probability that the
    next letter is b, given that the current

    How to Choose a secure


    password?
    Do NOT use words or phrases that have personal
    significance.
    Mix letters, numbers and symbols, and use case
    sensitivity
    Try to memorize the password, and avoid writing it
    down
    Do not use the same password for everything
    Use a password manager (PM). It is a utility that
    creates an encrypted file where your passwords are
    stored.
    Try to use "nonsense words."
    Do not tell anybody your password.

    You might also like